Develop Bugs

Hook API function WM6

I'm trying to hook api function "NKDbgPrintfW" from coredll.dll.
I use import table in-memory patch. It works fine for main module (exe file).
It hooks all calls from exe, but does not from dll it uses.
I think root of problem is that exe and loaded dlls use own import table and I patch only exe's one.
I use next function to hook exe api calls:
Code:
DWORD ic_PatchProcImports ( HANDLE hProc, DWORD dFind, DWORD dReplace )
{
DWORD ret = 0;
/* GODMODE ON */
BOOL bOldKMode = SetKMode ( TRUE );
DWORD dOldPerms = SetProcPermissions ( 0xFFFFFFFF );
/* get process ptr prom handle */
HDATA * hProcHD = ( HDATA * ) ( 0x80000000 | ( ( DWORD ) hProc & HANDLE_ADDRESS_MASK ) );
PROCESS * prc = ( PROCESS * ) hProcHD->pvObj;
/* get imports sections */
struct ImpHdr * blockptr, * blockstart;
blockstart = ( struct ImpHdr * ) MapPtrProc ( prc->e32.e32_vbase + prc->e32.e32_unit[IMP].rva, prc );
/* iterate thru imports sections */
for ( blockptr = blockstart; blockptr->imp_lookup; ++blockptr )
{
DWORD dOldProtect, tmp;
/* get vectors ptr */
DWORD * vectors = ( DWORD * ) MapPtrProc ( prc->e32.e32_vbase + blockptr->imp_address, prc );
/* count vectors */
DWORD * vptr = vectors;
while ( * vptr ) ++vptr;
DWORD vcnt = ( vptr - vectors );
/* try to unlock imports section memory */
if ( VirtualProtect ( vectors, vcnt * sizeof ( DWORD ), PAGE_EXECUTE_READWRITE, &dOldProtect ) )
{
/* find&replace */
for ( UINT i = 0; i < vcnt; ++i )
{
if ( vectors[i] == dFind )
{
vectors[i] = dReplace;
++ret;
}
}
/* lock back */
VirtualProtect ( vectors, vcnt * sizeof ( DWORD ), dOldProtect, &tmp );
}
}
/* GODMODE OFF */
SetProcPermissions ( dOldPerms );
SetKMode ( bOldKMode );
/* */
return ret;
}
I tried to find import table in loaded dll module but failed.
Here is the code I used:
Code:
DWORD ic_PatchModuleImports ( HANDLE hProc, Module* mod, DWORD dFind, DWORD dReplace )
{
DWORD ret = 0;
/* GODMODE ON */
BOOL bOldKMode = SetKMode ( TRUE );
DWORD dOldPerms = SetProcPermissions ( 0xFFFFFFFF );
/* get process ptr prom handle */
HDATA * hProcHD = ( HDATA * ) ( 0x80000000 | ( ( DWORD ) hProc & HANDLE_ADDRESS_MASK ) );
PROCESS * prc = ( PROCESS * ) hProcHD->pvObj;
/* get imports sections */
ImpHdr *blockptr, *blockstart;
blockstart = ( ImpHdr * ) MapPtrProc(mod->e32.e32_vbase + mod->e32.e32_unit[IMP].rva, prc);
/* iterate thru imports sections */
for ( blockptr = blockstart; blockptr->imp_lookup; ++blockptr )
{
// NKDbgPrintfW(L"%s", blockptr->imp_dllname);
//DWORD dOldProtect, tmp;
/* get vectors ptr */
DWORD * vectors = ( DWORD * ) MapPtrProc(mod->e32.e32_vbase + blockptr->imp_address, prc);
/* count vectors */
DWORD * vptr = vectors;
while ( * vptr ) ++vptr;
DWORD vcnt = ( vptr - vectors );
/* try to unlock imports section memory */
//if ( VirtualProtect ( vectors, vcnt * sizeof ( DWORD ), PAGE_EXECUTE_READWRITE, &dOldProtect ) )
{
/* find&replace */
for ( UINT i = 0; i < vcnt; ++i )
{
NKDbgPrintfW(L"Serach for: %x; Found: %x", dFind, vectors[i]);
if ( vectors[i] == dFind )
{
vectors[i] = dReplace;
++ret;
}
}
/* lock back */
// VirtualProtect ( vectors, vcnt * sizeof ( DWORD ), dOldProtect, &tmp );
}
}
/* GODMODE OFF */
SetProcPermissions ( dOldPerms );
SetKMode ( bOldKMode );
/* */
return ret;
}
I'm looking for any way to hook this function, but I prefer in-memory import table patch..

Hello!
Perhaps this will help:
http://forum.xda-developers.com/showthread.php?t=372496
I am also working on a program that needs hooks. My problem right now is that I need to create the header with all the structure definitions (PROCESS, THREAD, ect). I found this but it is most likely for an older CE version as it was written in 2003:
http://nah6.com/~itsme/cvs-xdadevtools/itsutils/old/cenk.h
Do you have these definitions for wince 5.x?

I think, you can find it in Windows Mobile Platform SDK .
MS sells that SDK, but if you google it, you'll find a place where you can download it for free

I was working on a similar problem but I decided to make a generic hook that didn't rely only on import table. Thanks to itutils I was able to hook some functions until when I found out that there two methods for making api calls, the standard one and the "speedy" one. I wasn't able to hook any function that was using the second method and after a bit I gave up. How did you overcome this problem?
Any suggestion is welcome, thank you

I still have not solved my problem. I am trying to hook calls to keybd_event in coredll from keypad.dll. I think the root of the problem is that that keypad.dll is in ROM. Therefore the thunk table that is actually inside keypad.dll is not readable or writeable at runtime. I think there is a thunk table created in RAM somewhere else where the function pointers are actually stored. I can find it by analyzing keypad.dll and finding the hex location to where the runtime thunk table is, but I cant find a way to figure it out at runtime so that my hook will work with any dll.

I use the PerformCallback4 DLL hooking and it's working with ROM files. But I'd also be interested if there's a way to inject into a process without needing to load a separate DLL.

Well process injection is not my problem. I am trying to hook calls from a service dll. All I did was add my dll as a service and I am kindly loaded at boot. Its the hooking I cant get to work. How are you accomplishing the hook? I just want to hook all calls from other services to keybd_event.

What _exactly_ do you guys want to do? I may be able to assist.
I know the answers to most questions I see here, but I will simply not give out the code to do this, because it is "dangerous" code. By that I do not mean it is not somewhat reliable, but dangerous to commercial developers as these techniques allow you to crack pretty any commercial app with minimal effort...
(see my notice about having easily bypassed the MS Marketplace "advanced protection" on various news sites for an example of how bad this can be)

Actually I'd be curious to know how to hook an API that can use the kmode speedup, that is one that's using g_pKmodeEntries. I'm not interesting into cracking anything but at this point I'm curious to know how to go ahead.
Thanx for any help.

I heard that the DLL injection hooks won't work for WinCE 6.0 (--> WM 7) but what about the mentioned "kmode speedup"?

bbbird1 said:
Actually I'd be curious to know how to hook an API that can use the kmode speedup, that is one that's using g_pKmodeEntries. I'm not interesting into cracking anything but at this point I'm curious to know how to go ahead.
Thanx for any help.
Click to expand...
Click to collapse
Well there are various ways to patch functions out. The problem is that there are several ways that a kernel function can ultimately be called. Of course there are also various ways to go about patching these functions. To name a few:
(1) Patch the apiset tables and overwrite the function address the trap jumps to. If this is the same table and address are used for the g_pKmodeEntries jump I am not sure - you would have to do some IDA'ing / testing to figure that one out
(2) Patch the import tables of the executable / dll calling this function, if you have a specific target in mind (with some small trickery this can be adapted to also patch 'dynamic imports', i.e. GetProcAddress, even after the call was made)
(3) Patch the export table of coredll (actually if this one matches your wishes, I usually use 4 instead)
(4) Patch the function inside coredll directly by (saving first and then) overwriting the first few instructions with a jump to your code
(5) Patch the actual function inside nk or the other exe server (closely related to 4)
Each method has it's own pros and cons, injection/controlled-leak/code requirements and may or may not work with certain way of calling the function. Some of these patches are much more difficult to do than others...
You'd have to figure out for your function which method might actually work. For example I usually have great results with method 4, however it will not catch some ways of kernel-internal calls, so you have to confirm first with some heavy IDA'ing to see if internal calls exist (completely bypassing coredll, for most functions they actually don't). Unfortunately that I recall I have not tried patching any g_pKmodeEntries intentionally (as in I might have patched such functions, but not knowingly).
RAMMANN said:
I heard that the DLL injection hooks won't work for WinCE 6.0 (--> WM 7) but what about the mentioned "kmode speedup"?
Click to expand...
Click to collapse
Well we'd pretty much have to start from scratch again, figuring a lot of stuff out, but I'm sure we'll find new and exciting ways of hooking kmode speedup might still be there, though, but likely in a different form.

Chainfire said:
What _exactly_ do you guys want to do? I may be able to assist.
I know the answers to most questions I see here, but I will simply not give out the code to do this, because it is "dangerous" code. By that I do not mean it is not somewhat reliable, but dangerous to commercial developers as these techniques allow you to crack pretty any commercial app with minimal effort...
(see my notice about having easily bypassed the MS Marketplace "advanced protection" on various news sites for an example of how bad this can be)
Click to expand...
Click to collapse
Hello chainfire! I am trying to hook keyboard events comming from the keypad driver. There is a service that runs to detect key interrupts and when it does detect them it calls keybd_event to broadcast the event. keybd_event is in coredll. The keypad service is loaded from keypad.dll (in most ROMs). So I want to hook calls from keypad.dll to keybd_event in coredll. The problem is that I want it to work regardless of ROM version and there are different versions of keypad.dll, and some ROMs dont have it at all. Therefore I want to hook all calls to keybd_event from services. I added my dll as a service so injection method is not a problem. Now I need to hook.
Using IDA I found the address of the IAT in keypad, but the IAT that exists in the dll itself is not readable or writeable. It seems that there is a thunk table that gets created in RAM separate from where the dll is loaded. Each process seems to create it's own RAM thunk table for loaded dlls (my guess is just those in ROM). I dont know how to programmatically find these thunk tables.
Do I make sense? This is of course targeting WM6.x (wce5). I just need some way to hook calls to keybd_event from all dlls loaded in the current process. Some of those dlls may be in ROM but they need to be hooked too.

Chainfire said:
Well there are various ways to patch functions out. The problem is that there are several ways that a kernel function can ultimately be called. Of course there are also various ways to go about patching these functions. To name a few:
(1) Patch the apiset tables and overwrite the function address the trap jumps to. If this is the same table and address are used for the g_pKmodeEntries jump I am not sure - you would have to do some IDA'ing / testing to figure that one out
(2) Patch the import tables of the executable / dll calling this function, if you have a specific target in mind (with some small trickery this can be adapted to also patch 'dynamic imports', i.e. GetProcAddress, even after the call was made)
(3) Patch the export table of coredll (actually if this one matches your wishes, I usually use 4 instead)
(4) Patch the function inside coredll directly by (saving first and then) overwriting the first few instructions with a jump to your code
(5) Patch the actual function inside nk or the other exe server (closely related to 4)
Each method has it's own pros and cons, injection/controlled-leak/code requirements and may or may not work with certain way of calling the function. Some of these patches are much more difficult to do than others...
You'd have to figure out for your function which method might actually work. For example I usually have great results with method 4, however it will not catch some ways of kernel-internal calls, so you have to confirm first with some heavy IDA'ing to see if internal calls exist (completely bypassing coredll, for most functions they actually don't). Unfortunately that I recall I have not tried patching any g_pKmodeEntries intentionally (as in I might have patched such functions, but not knowingly).
Well we'd pretty much have to start from scratch again, figuring a lot of stuff out, but I'm sure we'll find new and exciting ways of hooking kmode speedup might still be there, though, but likely in a different form.
Click to expand...
Click to collapse
I like the sound of (3). Why Use (4) instead? How do you find the export table programmatically? If I use this method, as long as my service is loaded first it should work.

Ok I just tried something and it worked. It seems that these RAM thunk tables are always loaded at 0x01bb5000 for every process. The following code worked:
Code:
coremod = GetModuleHandle(L"coredll.dll");
o_keybd_event = (_keybd_event)GetProcAddress(coremod, L"keybd_event");
my_kbe = (DWORD)(my_keybd_event);
addr = (DWORD*)(0x01bb5000);
VirtualProtect(addr, 4, PAGE_READWRITE, NULL);
while(ReadProcessMemory(GetCurrentProcess(), addr, &dat, 4, NULL))
{
if(dat == (DWORD)o_keybd_event)
{
WriteProcessMemory(GetCurrentProcess(), addr, &my_kbe, 4, NULL);
kbe_hkd = TRUE;
}
addr++;
VirtualProtect(addr, 4, PAGE_READWRITE, NULL);
}
The thunk tables seem to be back to back and ReadProcessMemory seems to always fail at the end of them, so the loop does not run too long. Chainfire, does this make sense to you?

JKingDev said:
...
Do I make sense? This is of course targeting WM6.x (wce5). I just need some way to hook calls to keybd_event from all dlls loaded in the current process. Some of those dlls may be in ROM but they need to be hooked too.
Click to expand...
Click to collapse
Using IAT patch to do this is certainly possible but a lengthy process as you'd have to keep track for all dll loads in services.exe and patch each and every dll as it loads. One of the other methods I described may fit better.
JKingDev said:
I like the sound of (3). Why Use (4) instead? How do you find the export table programmatically? If I use this method, as long as my service is loaded first it should work.
Click to expand...
Click to collapse
(3) is actually (IMHO) a very annoying patch to implement. It doesn't easily allow you to patch/unpatch at will. It doesn't cover coredll-internal jumps. The timing/load-order has to be perfect. It requires slightly more memory. And because you have to load it before anything else if you screw something up there's a good chance you'll need a hard-reset to recover (that's a real ***** with testing!). You can get the export table from the e32 structure of the module, though it isn't always easily patched
JKingDev said:
Ok I just tried something and it worked. It seems that these RAM thunk tables are always loaded at 0x01bb5000 for every process. The following code worked:
The thunk tables seem to be back to back and ReadProcessMemory seems to always fail at the end of them, so the loop does not run too long. Chainfire, does this make sense to you?
Click to expand...
Click to collapse
ROM DLLs create a seperate data section in memory for every process it is loaded into, the IAT is also stored there. Note that the addresses / virtual memory are the same across processes, but different physical memory is used for each process (same as data sections for normal DLLs, though those are located at the normal addresses). To figure out where this memory is look at the rwLow and rwHigh members of the PMODULE structure. (actually I'm surprised you found the location without this )

Chainfire said:
ROM DLLs create a seperate data section in memory for every process it is loaded into, the IAT is also stored there. Note that the addresses / virtual memory are the same across processes, but different physical memory is used for each process (same as data sections for normal DLLs, though those are located at the normal addresses). To figure out where this memory is look at the rwLow and rwHigh members of the PMODULE structure. (actually I'm surprised you found the location without this )
Click to expand...
Click to collapse
That is the vital info I needed! Quick question, do I start searching at rwLow and end at rwHigh, or start at rw Low and end at rwLow+rwHigh?
Thanks!
*edit* Answering my own question, start searching at rwLow and end at rwHigh. I was still having problems because my MODULE structure definition is incorrect, but I was able to find where the information I needed was so it doesnt really matter. Thanks so much!!

How do i get folder size rapidly?!

I write a C# app for WindowsMobile.
in order to get a nonrecursive folder size i have this routine:
Code:
static long GetDirectorySize(String path)
{
long size = 0;
String []files = Directory.GetFiles(path);
foreach (String f in files)
{
FileInfo fi = new FileInfo(f);
size += fi.Length;
}
return size;
}
now, my directory (in Storage Card) has about 1000 files that has about 4MB of data alltogether.
the GetDirectorySize takes forever to execute (60 seconds or so) and provide a horribole user expericnce.
executing this in a thread does not help either - i need the response as fast as possibole.
I was wondering if someone could help me figure out how to get folder size (nonrecursive) more rapidly.
in general, i also want to find the older file in the directory and delete it (kid of cache operation). how do i do that without waiting forever to complete?
storing an index file might not be what i'm looking for.
Thanks

I don't know about C#, but in C++ I use GetDiskFreeSpaceEx function, see HERE.
PS,
I think this goes in the Q&A forum?

dgaud007 said:
I use GetDiskFreeSpaceEx function
Click to expand...
Click to collapse
This does not help with Folder size.
My intention is to manage Cache folder and monitor its size and clear out some cached files in case the cache size of the folder is too big.
getting the disk size is not the way to deal with folder size

You can use it for individual folders, as the folder name is the 1st input parameter. I've used at least for \My Documents which is a regular folder and it works. Here is an excerpt from MSDN:
lpDirectoryName [in, optional]
A directory on the disk.
If this parameter is NULL, the function uses the root of the current disk.
If this parameter is a UNC name, it must include a trailing backslash, for example, "\\MyServer\MyShare\".
This parameter does not have to specify the root directory on a disk. The function accepts any directory on a disk.
The calling application must have FILE_LIST_DIRECTORY access rights for this directory.
Click to expand...
Click to collapse
As per MSDN, here is how you implement it in C#:
Code:
[DllImport("kernel32.dll", CharSet=CharSet.Auto, SetLastError=true)]
internal static extern bool GetDiskFreeSpaceEx(string drive, out long freeBytesForUser, out long totalBytes, out long freeBytes);

I tested GetDiskFreeSpaceEx.
- The coredll has to be used instead kernel32dll (for WindowsMobile).
- the TotalBytes returns the SD card size (on which the folder exists)
- the freeBytesForUser equals FreeBytes and returns the free space in the SD card
this does return the folder size.
appreciate further help.
thanks

I double checked and you're right. Looks like you'll have to recurse while adding the individual sizes. I couldn't find an easier method in a brief search in google. Sorry about the confusion!
PS,
checkout this app...

I'm not that much of a C# expert but isn't the 1000 times calling "new" slowing down? I'd try to write a traditional C++ application using simple FindFirstFile and FindNextFile functions and compare speed towards the C# application. If it's faster then you can just build a C++ DLL and PInvoke her. I'm not sure if results are better but at least it's worth a try.

solution found
I managed to resolve this and get a speedy result by replacing with this code.
all the best.
Code:
private static long GetDirectorySize(String path)
{
long size = 0;
[COLOR="DarkGreen"] /* Slow code
String []files = Directory.GetFiles(path);
foreach (String f in files)
{
FileInfo fi = new FileInfo(f);
size += fi.Length;
} */[/COLOR]
DirectoryInfo di = new DirectoryInfo(path);
FileInfo []fi = di.GetFiles();
for (int i = 0; i < fi.Length; i++)
size += fi.Length;
return size;
}
btw: get my app at http://www.logelog.com/utils

HELP! Running external program process minimized using .NET

I'm stumped on how to do this...
I'm trying to call an external program (python CE) in my vb.net program to run a script. I'm using the following code and it works just fine... EXCEPT that it opens python.exe in the foreground, processes my script in an open window and closes it. I want the whole process to be invisible to the user. Python CE does not have a (working) console-less function, so I need to try to do it using .NET.
I can't figure it out!
Code:
Dim scriptfile As String
Dim pyProcess As New Process()
scriptfile = """\default.pyw"" ""1"" ""2"""
pyProcess.StartInfo.FileName = "\Program Files\Python25\python.exe"
pyProcess.StartInfo.Arguments = scriptfile
pyProcess.StartInfo.UseShellExecute = False
pyProcess.Start()
As you can see the UseShellExecute property set to false does nothing. Should I maybe try running this in a separate thread??

Here you have an example of how it should look like
Code:
Public Sub HTCRomTool(ByVal localeID As String)
Dim process As New Process
process.StartInfo.Arguments = (" /buildrom "".\FLASH\ferom.htcrtproj"" "".\FLASH\RUU_Signed_" & localeID & ".nbh""")
process.StartInfo.FileName = (Me.ToolsFolder & "\htcrt.exe")
process.StartInfo.CreateNoWindow = True
process.Start
Do While Not process.HasExited
Thread.Sleep(100)
Loop
process.Close
process.Dispose
End Sub

That you need to add your references and arguments

I appreciate it! and will try it out ASAP

CreateNoWindow does not show up as a member of system.diagnostics.process.StartInfo...
I'm using NET CF 3.5 and VS2008 refuses to accept that line.

The next example, the NET CF 3.5 and VS2008
Code:
Dim p As New Process()
p.UseShellExecute = True
p.StartInfo.FileName = "C:\Windows\Notepad.exe"
p.StartInfo.Verb = "runas"
p.Start()

And See This - Open NetCF

nokser said:
The next example, the NET CF 3.5 and VS2008
Code:
Dim p As New Process()
p.UseShellExecute = True
p.StartInfo.FileName = "C:\Windows\Notepad.exe"
p.StartInfo.Verb = "runas"
p.Start()
Click to expand...
Click to collapse
I appreciate the help, but that doesn't stop pythonCE from launching in its own window. I'm going to reinstall the SDKs just in case I screwed something up a while ago... other than that, I'll have to think on it.
OpenNetCF is interesting but the newest version (2.X) doesn't have the Process namespace anymore. They took it out with the advent of NET CF 2.0. I might try their deprecated version though (1.4)

For anyone else that is interested in this thread, I figured out a solution.
PythonCE does work on WM6.5 and the switch to run without a console/window opening is /nopcceshell.
HOWEVER, this won't work on the emulator that's part of VS2008 when you're debugging your software! If you use your own device on ActiveSync and debug your program on your physical device, it actually works. I'm running WM6.5.4 (I think).
There's no special code needed to run this in VB.NET... just start a process and pass "/nopcceshell" as the first argument. Then you can put your script name (needs full path) and any other arguments afterwards.
Oh man this was killing me.... SOLVED!

Pacman.edb: The source of all app related goodness... if we can crack it

Sup..
So did some quick playing around today, trying to figure out where installed applications and their data is stored. Well, it didn't really take long, as I found \Application Data\Microsoft\PackageManager, containing pacman.edb and pacman.edb (as well as matching .snt files with 0 bytes).
If you're not already aware, the package manager stores the manifest data in it, which means any changes to the manifest do not take place unless the application is reinstalled, in which the package manager updates the database.
By manipulating this data, a lot of really neat things can happen. To my current knowledge, this includes:
-Hiding applications from the start list
-Enabling applications to resume on launch, rather than "replace" the previous entity
-Change icons, name, etc
-Manipulate application Tasks
-Better understand how the DRM and capabilities work
-etc etc
So here's what I know so far, and here's where I'm stuck. I have pacman.edb and pacman2.edb. The first file contains mostly system info, stuff I don't really recognize. The second file contains all the applications on the device, both system and user installed. This also lists all their tokens, capabilities, modes, flags, etc. But here's the issue: These files use some variation of CEDB, the Windows CE version of the EDB format.
Reading EDB is enough of a pain already, because not a lot of information is available on it. There are *some* CEDB tools out there, but they all seem to rely on old (WM2003) formats.
If I was good at reading bytes and figuring this kind of stuff out, I'd get to work, but that's never been my forté. If anyone has some useful info, knowledge I'm missing, or is really good with reading hex dumps, do share
Attached are the two files from my device. I realize they probably contain a great deal of info, but for the sake of trying to crack open this mess, I figured the embarrassment of publicly announcing that I have "Brostache" installed was well worth the potential benefits
Any info, pointers, etc, will be much appreciated by Windows Phone users alike, if we can get this figured out

Wow, lots of potential here. Among other things, I suspect that the interop-locked behavior is determined by a setting in here somewhere (after all, OEM apps with ID_CAP_INTEROPSERVICES work just fine even on an interop-locked Mango phone).
This also might allow the creation of custom "hubs" of apps, or at the very least the ability to invoke other apps from within an app (already possible with built-in apps but not yet with third-party).

GoodDayToDie said:
This also might allow the creation of custom "hubs" of apps, or at the very least the ability to invoke other apps from within an app (already possible with built-in apps but not yet with third-party).
Click to expand...
Click to collapse
That's been possible since.. June? May? Just use fiinix's DllImport library and execute the GUID. It's what my folders application uses.

I stand corrected, then. I've seen several apps that can invoke built-in apps but none that could invoke third-party.

Just providing with some information.
You are probably searching for those dll's:
- \SYS\CommsPlatform\unistore.dll
Code:
Resource data (not dll exports):
EDB_ReadRecordPropsWithPrimaryId
EDB_CeWriteRecordProps
EDB_CeReadRecordPropsEx
EDB_SeekAndReadRecordProps
EDB_CeDeleteRecord
EDB_CeOpenStream
-\SYS\CoreOS\coredll.dll
Code:
HANDLE CeOpenDatabase(PCEOID poid, LPWSTR lpszName, CEPROPID propid, DWORD dwFlags, HWND hwndNotify)
HANDLE CeOpenDatabaseEx(PCEGUID pguid, PCEOID poid, LPWSTR lpszName, CEPROPID propid, DWORD dwFlags, CENOTIFYREQUEST *pReq)
HANDLE CeOpenDatabaseEx2(PCEGUID pguid, PCEOID poid, LPWSTR lpszName, SORTORDERSPECEX *pSort, DWORD dwFlags, CENOTIFYREQUEST *pReq)
BOOL CeMountDBVol(PCEGUID pguid, LPWSTR lpszVol, DWORD dwFlags)
BOOL CeUnmountDBVol(PCEGUID pguid)
BOOL CeDeleteRecord(HANDLE hDatabase, CEOID oidRecord)
HANDLE CeFindFirstDatabaseEx(PCEGUID pguid, DWORD dwClassID)
BOOL CeGetDBInformationByHandle(HANDLE hDbase, LPBY_HANDLE_DB_INFORMATION lpDBInfo)
- CeOpenDatabase

fiinix said:
Just providing with some information.
You are probably searching for those dll's:
- \SYS\CommsPlatform\unistore.dll
Code:
Resource data (not dll exports):
EDB_ReadRecordPropsWithPrimaryId
EDB_CeWriteRecordProps
EDB_CeReadRecordPropsEx
EDB_SeekAndReadRecordProps
EDB_CeDeleteRecord
EDB_CeOpenStream
-\SYS\CoreOS\coredll.dll
Code:
HANDLE CeOpenDatabase(PCEOID poid, LPWSTR lpszName, CEPROPID propid, DWORD dwFlags, HWND hwndNotify)
HANDLE CeOpenDatabaseEx(PCEGUID pguid, PCEOID poid, LPWSTR lpszName, CEPROPID propid, DWORD dwFlags, CENOTIFYREQUEST *pReq)
HANDLE CeOpenDatabaseEx2(PCEGUID pguid, PCEOID poid, LPWSTR lpszName, SORTORDERSPECEX *pSort, DWORD dwFlags, CENOTIFYREQUEST *pReq)
BOOL CeMountDBVol(PCEGUID pguid, LPWSTR lpszVol, DWORD dwFlags)
BOOL CeUnmountDBVol(PCEGUID pguid)
BOOL CeDeleteRecord(HANDLE hDatabase, CEOID oidRecord)
HANDLE CeFindFirstDatabaseEx(PCEGUID pguid, DWORD dwClassID)
BOOL CeGetDBInformationByHandle(HANDLE hDbase, LPBY_HANDLE_DB_INFORMATION lpDBInfo)
- CeOpenDatabase
Click to expand...
Click to collapse
Ah, nice find! Any chance of running these DLLs on my desktop? I know the emulator is x86, but not sure about how marshal calls would work on an emulator module..

GoodDayToDie said:
I stand corrected, then. I've seen several apps that can invoke built-in apps but none that could invoke third-party.
Click to expand...
Click to collapse
Phone.Search.SearchFor("OMG how is this even possible :O");
-- Phone.AppLauncher.LaunchBuiltInApplication(AppLauncher.Apps.SearchHome, "SearchResults?QueryString=" + value);
---- LaunchApplication(GuidFromApp(app), value);
------ internalLaunch(guid, task);
[
var args = string.Format("app://{0}/{1}", guid.ToString("D").ToUpper(), task ?? "");
var re = DllImportCaller.lib.StringCall("aygshell", "SHLaunchSessionByUri", args);
]
The glorious "SHLaunchSessionByUri" allows us to start anything with any application guid.
Phone.AppLauncher.LaunchApplication("{8dc5214e-88fa-4c2d-a379-2cd74fe24b72}", "_default");
- To start DllImport Project from within DllImport Project
---------- Post added at 02:17 PM ---------- Previous post was at 02:08 PM ----------
Jaxbot said:
Ah, nice find! Any chance of running these DLLs on my desktop? I know the emulator is x86, but not sure about how marshal calls would work on an emulator module..
Click to expand...
Click to collapse
http://www.koders.com/csharp/fid0E5D18C95EDCC856BA4CB706535EC9933250BD56.aspx?s=usb
Code:
[PreserveSig]
IntPtr CeOpenDatabaseEx(
ref Guid pceguid,
ref int poid,
[In, MarshalAs(UnmanagedType.LPWStr)] string lpszName,
int propid,
[In] int dwFlags,
ref IntPtr /*CENOTIFYREQUEST*/ pReq);
This is the C# signature.
To be able to execute it, a c++ COM+ must make the call due c# cant do it alone.

fiinix said:
Phone.Search.SearchFor("OMG how is this even possible :O");
-- Phone.AppLauncher.LaunchBuiltInApplication(AppLauncher.Apps.SearchHome, "SearchResults?QueryString=" + value);
---- LaunchApplication(GuidFromApp(app), value);
------ internalLaunch(guid, task);
[
var args = string.Format("app://{0}/{1}", guid.ToString("D").ToUpper(), task ?? "");
var re = DllImportCaller.lib.StringCall("aygshell", "SHLaunchSessionByUri", args);
]
The glorious "SHLaunchSessionByUri" allows us to start anything with any application guid.
Phone.AppLauncher.LaunchApplication("{8dc5214e-88fa-4c2d-a379-2cd74fe24b72}", "_default");
- To start DllImport Project from within DllImport Project
---------- Post added at 02:17 PM ---------- Previous post was at 02:08 PM ----------
http://www.koders.com/csharp/fid0E5D18C95EDCC856BA4CB706535EC9933250BD56.aspx?s=usb
Code:
[PreserveSig]
IntPtr CeOpenDatabaseEx(
ref Guid pceguid,
ref int poid,
[In, MarshalAs(UnmanagedType.LPWStr)] string lpszName,
int propid,
[In] int dwFlags,
ref IntPtr /*CENOTIFYREQUEST*/ pReq);
This is the C# signature.
To be able to execute it, a c++ COM+ must make the call due c# cant do it alone.
Click to expand...
Click to collapse
Not even C# on my desktop, eh? hmm...

Jaxbot said:
Not even C# on my desktop, eh? hmm...
Click to expand...
Click to collapse
Heh, NOPE, needs and can only be executed from WP7

fiinix said:
Heh, NOPE, needs and can only be executed from WP7
Click to expand...
Click to collapse
Well, at least direct support suddenly became less of an issue =p But, won't we need higher privileges to go snooping around system databases?

Direct edit [blocked, umad?].
Edit on external placed EDB [ok]
<Macro Id="ELEVATED_RIGHTS_RESOURCE_GROUP_NAME" Description="Elevated Rights Resource Group SID" Value="S-1-5-112-0-0X14" />
You will need "Elevated Rights" to edit the file (when located @ /PACKAGEMANAGER/*)
- Editing from /Applications/Install/{GUID}/Install/ (you are OK)
- (Solution) Edit => override system file (maybe possible?)
"PACMAN.EDB" block policy
Code:
<Rule PriorityCategoryId="PRIORITY_HIGH" ResourceIri="/FILESYS/PRIMARY/APPLICATION%20DATA/MICROSOFT/PACKAGEMANAGER/PACMAN.EDB" SpeakerAccountId="S-1-5-112-0-0-1" Description="Allow all in Standard Rights Chamber to access the Package Manager database ">
<Authorize>
<Match AccountId="S-1-5-112-0-0X14" AuthorizationIds="FILE_ALL_ACCESS, FILE_GENERIC_READ, FILE_GENERIC_WRITE, FILE_GENERIC_EXECUTE, FILE_READ_ATTRIBUTES, FILE_WRITE_ATTRIBUTES, FILE_LIST_DIRECTORY" />
<Match AccountId="S-1-5-112-0-0X23" AuthorizationIds="FILE_GENERIC_READ, FILE_READ_ATTRIBUTES, FILE_LIST_DIRECTORY" />
</Authorize>
<Stop>
<Match AccountId="S-1-5-112-0-0XFF" />
</Stop>
</Rule>
edit:
<Macro Id="STANDARD_RIGHTS_RESOURCE_GROUP_NAME" Description="Standard Rights Resource Group SID" Value="S-1-5-112-0-0X23" />
"Standard Rights" for enumerating the installed info.

fiinix said:
Direct edit [blocked, umad?].
Edit on external placed EDB [ok]
<Macro Id="ELEVATED_RIGHTS_RESOURCE_GROUP_NAME" Description="Elevated Rights Resource Group SID" Value="S-1-5-112-0-0X14" />
You will need "Elevated Rights" to edit the file (when located @ /PACKAGEMANAGER/*)
- Editing from /Applications/Install/{GUID}/Install/ (you are OK)
- (Solution) Edit => override system file (maybe possible?)
"PACMAN.EDB" block policy
Code:
<Rule PriorityCategoryId="PRIORITY_HIGH" ResourceIri="/FILESYS/PRIMARY/APPLICATION%20DATA/MICROSOFT/PACKAGEMANAGER/PACMAN.EDB" SpeakerAccountId="S-1-5-112-0-0-1" Description="Allow all in Standard Rights Chamber to access the Package Manager database ">
<Authorize>
<Match AccountId="S-1-5-112-0-0X14" AuthorizationIds="FILE_ALL_ACCESS, FILE_GENERIC_READ, FILE_GENERIC_WRITE, FILE_GENERIC_EXECUTE, FILE_READ_ATTRIBUTES, FILE_WRITE_ATTRIBUTES, FILE_LIST_DIRECTORY" />
<Match AccountId="S-1-5-112-0-0X23" AuthorizationIds="FILE_GENERIC_READ, FILE_READ_ATTRIBUTES, FILE_LIST_DIRECTORY" />
</Authorize>
<Stop>
<Match AccountId="S-1-5-112-0-0XFF" />
</Stop>
</Rule>
edit:
<Macro Id="STANDARD_RIGHTS_RESOURCE_GROUP_NAME" Description="Standard Rights Resource Group SID" Value="S-1-5-112-0-0X23" />
"Standard Rights" for enumerating the installed info.
Click to expand...
Click to collapse
Ok, got a plan then =P If I have time today, I'll try and create a C# program to read edb files, and place my pacman files in the Install directory. My C++ is rusty though, so if you have time to waste, feel free to beat me to it

Not sure if im doing it right
- First time working with CE databases (Using google)
[Testing] Ill just check the error codes if success.
CEOID poid;
CeOpenDatabase(&poid, L"pacman.edb", 0,CEDB_AUTOINCREMENT, 0);
CEOIDINFO * info = (CEOIDINFO*)malloc(sizeof(CEOIDINFO));
ZeroMemory(info, sizeof(CEOIDINFO));
CeOidGetInfo(poid, info);
edit:
Making some progress:
- returned: ERROR_FILE_NOT_FOUND
MSDN: CeMountDBVol is obselete => use CeMountDBVolEx (above returned -1 (CeOpenDatabase))
Help code (Ce lib): http://nah6.com/~itsme/cvs-xdadevtools/itsutils/dll/PoomInterface.cpp
Current code:
Code:
typedef BOOL (*FN_CeMountDBVolEx)( PCEGUID pGuid, LPWSTR lpwszDBVol, CEVOLUMEOPTIONS* pOptions, DWORD dwFlags);
STDMETHODIMP CMangoClass::DatabaseTestWork()
{
FN_CeMountDBVolEx CeMountDBVolEx = (FN_CeMountDBVolEx)GetProcAddress(LoadLibrary(L"coredll.dll"), L"CeMountDBVolEx");
LPWSTR str = TEXT("pacman.edb"); // => ERROR_FILE_NOT_FOUND (different path needed)
CEGUID _mvolguid;
memset(&_mvolguid, 0, sizeof(CEGUID));
BOOL ok = CeMountDBVolEx(&_mvolguid, str, NULL,OPEN_EXISTING);
return ok;
}
edit 2:
Aw! FFS!
Changed to: TEXT("\\Applications\\Install\\8DC5214E-88FA-4C2D-A379-2CD74FE24B72\\Install\\pacman.edb");
- ERROR_ACCESS_DENIED
Maybe needs to be located in isolation storage or \Data\
edit 3:
WOAH
- NO_ERROR
TEXT("\\Applications\\Data\\8DC5214E-88FA-4C2D-A379-2CD74FE24B72\\Data\\IsolatedStore\\pacman.edb");
I could expect this due the WRITE+READ under \Install\ is policy blocked, where \IsolatedStore\ is full access (sandbox: "this-app")
edit 4:
What im currently able doing:
Code:
var db = "\\Applications\\Data\\8DC5214E-88FA-4C2D-A379-2CD74FE24B72\\Data\\IsolatedStore\\pacman.edb";
bool suc;
int guidAddr = DllImportCaller.lib.EDB_Mount(db, out suc);
if (!suc)
{
var erra = (WinError)DllImportCaller.lib.GetLastError7();
}
else
{
var sessionHandle = DllImportCaller.lib.EDB_OpenMounted(db, guidAddr);
//Currently trying to get this one working (erra: INVALID_PARAMETER) => Probably "SORTORDERSPECEX"
var erra = (WinError)DllImportCaller.lib.GetLastError7();
}
edit 5:
The db handles mounted (within pacman):
805306371,
805306369,
805306383,
805306381,
805306373
Code:
var first = DllImportCaller.lib.EDB_FindFirstDB(guidAddr);
var dbHandles = new List<int>();
int dbHandle;
var erraA = (WinError)DllImportCaller.lib.GetLastError7();
while ((dbHandle = DllImportCaller.lib.EDB_FindNextDB(first, guidAddr)) != 0)
{
dbHandles.Add(dbHandle);
var erra = (WinError)DllImportCaller.lib.GetLastError7();
}
var sortDuplicate = dbHandles.Distinct().ToArray();

Hey! I was working on that a while ago. But I'm too busy with other things, so I put it on hold. Good luck!
http://forum.xda-developers.com/showthread.php?p=15205597#post15205597
Ciao,
Heathcliff74

Heathcliff74 said:
Hey! I was working on that a while ago. But I'm too busy with other things, so I put it on hold. Good luck!
http://forum.xda-developers.com/showthread.php?p=15205597#post15205597
Ciao,
Heathcliff74
Click to expand...
Click to collapse
Could you send the C++ code for that?
I have come a long way, but it would speed up more

fiinix said:
Could you send the C++ code for that?
I have come a long way, but it would speed up more
Click to expand...
Click to collapse
Pwoo. I really got to look for that. Not sure I still have this. I will look for it tomorrow.

"Because i can"-moment: Attachment
Mom, look, i extracted the tables lol
Well, it works fast extracting the table names

Guys, this is awesome, and fantastic job whipping it up so fast - I'll try and step in when I can.
If you can edit the database file, it's quite possible we'll be able to replace it using the XAP exploit. No guarantee of course - the installer may take a lock on the DB file before unpacking the XAP, in which case the unpack would fail.
Of course, you'd need to not overwrite the database or your installed apps (and quite possibly the built-in ones) would probably stop working. I wonder if the phone would load a pacman3.edb if you put it in the right folder...

[Q] [Win 8 JS dev] Uglified, Concated, UTF-8 + BOM encoded JS files for a Windows App

Hey everybody,
I'm currently porting my company's webapp to Windows 8. As being written 99% in JavaScript, I just started a new Windows Store JS App project in Visual Studio and moved all of my code in. After some fixes, the app is running fine now.
For deployment, I'm using grunt with grunt-contrib-uglify to concat and minify my JS files. They are saved with UTF-8 encoding und the windows app runs fine using those minified scripts. But the WACK certification fails because those files don't contain the BOM (Byte Order Marker).
I now added a step to my grunt setup, which adds the BOM to those JS files by reading the filecontent as buffer and re-save it with \uFFEF (the BOM) at the beginning. That leads to correctly encoded files, passing the certification.
The funny part is:
When I run the app as Debug or Release right from VS (with debugger), the app is working fine.
If I bundle the app for store submit and start it with the debugger attached, it's also running fine. But if I start the app without the debugger, the scripts are not being loaded.
Do you have a tip for me?

ice8lue said:
Hey everybody,
I'm currently porting my company's webapp to Windows 8. As being written 99% in JavaScript, I just started a new Windows Store JS App project in Visual Studio and moved all of my code in. After some fixes, the app is running fine now.
For deployment, I'm using grunt with grunt-contrib-uglify to concat and minify my JS files. They are saved with UTF-8 encoding und the windows app runs fine using those minified scripts. But the WACK certification fails because those files don't contain the BOM (Byte Order Marker).
I now added a step to my grunt setup, which adds the BOM to those JS files by reading the filecontent as buffer and re-save it with \uFFEF (the BOM) at the beginning. That leads to correctly encoded files, passing the certification.
The funny part is:
When I run the app as Debug or Release right from VS (with debugger), the app is working fine.
If I bundle the app for store submit and start it with the debugger attached, it's also running fine. But if I start the app without the debugger, the scripts are not being loaded.
Do you have a tip for me?
Click to expand...
Click to collapse
Build project as release and THEN create the app package check for breakpoints. Also does it run uncompressed?
Can you provide the code or the package?

Toxickill said:
Build project as release and THEN create the app package check for breakpoints. Also does it run uncompressed?
Click to expand...
Click to collapse
Doesn't the Package process do the build on it's own?
It is working when I load all the single JS files (that grunt is merging into one) and add the BOM to all of them. If I just concat those files without compression/minification it's working, together with the added BOM it's not...
There are no errors (I added an error listener), they simply don't get loaded.
---
I tried your solution, but it ends the same. The interesting part is, if I use publish rather than build, it gets installed und IS running without a debugger. After packaging, it's not...

The marker you are adding is for the UTF format MS uses... However you are encoding to UTF-8...

Toxickill said:
The marker you are adding is for the UTF format MS uses... However you are encoding to UTF-8...
Click to expand...
Click to collapse
This is, basically, what I'm doing to those JS files after concat/minify:
Code:
var buf = grunt.file.read(fileName, { encoding: null });
var missingBOM = (buf[0] !== 0xEF && buf[1] !== 0xBE && buf[2] !== 0xBB);
if (missingBOM) {
grunt.file.write(fileName, '\ufeff' + buf, { encoding: 'utf-8' });
}

See here http://msdn.microsoft.com/en-us/library/windows/desktop/dd374101(v=vs.85).aspx
Im mobile so im sorry for link.. But you are using the wrong marker for the encoding see here for a table.

Toxickill said:
See here http://msdn.microsoft.com/en-us/library/windows/desktop/dd374101(v=vs.85).aspx
Im mobile so im sorry for link.. But you are using the wrong marker for the encoding see here for a table.
Click to expand...
Click to collapse
Hmm... but it's the same marker as VS adds when I'm manually saving them with UTF8-signed encoding. EF BB BF adds cryptical symbols but no BOM...

Can you create me a blank program compress it and send it to me so i can see if it does not work and i ca debug it as well.

Toxickill said:
Can you create me a blank program compress it and send it to me so i can see if it does not work and i ca debug it as well.
Click to expand...
Click to collapse
I'm sorry, I can't give out the code...
This is essentially what it does:
HTML:
HTML:
<!DOCTYPE html>
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1" />
<link rel="stylesheet" href="%dest%css/%lib-css%" />
<link rel="stylesheet" href="%dest%css/%app-css%" />
</head>
<body>
<div id="wrapper"></div>
<script>
var script = document.createElement('script');
script.async = false;
script.type="text/javascript";
script.charset = "utf-8";
script.onload = function() {
...
};
script.src = '%dest%js/%libs-js%';
document.head.appendChild(script);
var script = document.createElement('script');
script.async = false;
script.type="text/javascript";
script.charset = "utf-8";
script.onload = function() {
... (initialize app,...)
};
script.src = '%dest%js/%app-js%';
document.head.appendChild(script);
</script>
</body>
</html>
What my grunt script does is minify all JS files into app.js and libs.js, the CSS into app.css and libs.css and replace the %var% variables with the corresponding files/folders.
My script now writes the correct BOM to the file and also removes possible BOMs in the file left from the source files during merging:
Code:
var buf = grunt.file.read(dist + fileName, { encoding: null });
var BOM = new Buffer([0xEF,0xBB,0xBF]);
// remove multi BOMs from Buffer
var bufString = buf.toString('utf-8');
bufString = bufString.replace(BOM.toString('utf-8'), null);
buf = new Buffer(bufString, 'utf-8');
// add new UTF-8 BOM to the beginning of the file buffer
var bomFile = Buffer.concat([BOM,buf]);
grunt.file.write(dist + fileName, bomFile, { encoding: 'utf-8' });
I double-checked via a HEX editor that the resulting files 1. contain the correct BOM at the beginning and 2. don't contain any additional BOMs (neither the UTF8 nor the THF16 one).
Still, no luck launching the app without a debugger, my JS is not loaded/parsed...

No ideas guys?

ice8lue said:
No ideas guys?
Click to expand...
Click to collapse
Sorry, ive been working the 8.1 jailbeak, try keeping your scrips in the same directory and referencing them with the file name only...
This could be the problem....
Code:
%dest%js/%libs-js%
Im not familiar with JS windows store apps.

Toxickill said:
Sorry, ive been working the 8.1 jailbeak, try keeping your scrips in the same directory and referencing them with the file name only...
This could be the problem....
Code:
%dest%js/%libs-js%
Im not familiar with JS windows store apps.
Click to expand...
Click to collapse
No problem in general, but we're eager to release the app.
The code path is correct, these are variables, being overwritten during deployment.

Update:
It looks like it's really the combination of merged JS files by uglifyJS and the BOM that causes this problem. I now disabled the merge, loading all of the files seperately (but in a minified form) with the BOM added. The app now succeeds certification AND is running without a debugger.
This is ugly, but it's working - finally.